Lucene search

K
rosalinuxROSA LABROSA-SA-2021-1953
HistoryJul 02, 2021 - 5:59 p.m.

Advisory ROSA-SA-2021-1953

2021-07-0217:59:22
ROSA LAB
abf.rosalinux.ru
8

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.022

Percentile

89.5%

Software: poppler 0.26.5
OS: Cobalt 7.9

CVE-ID: CVE-2017-7511
CVE-Crit: MEDIUM
CVE-DESC: poppler, since version 0.17.3, was vulnerable to null pointer dereferencing in pdfunite caused by specially crafted documents.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2017-7515
CVE-Crit: MEDIUM
CVE-DESC: poppler before version 0.55.0 is vulnerable to uncontrolled recursion in pdfunite, which can lead to denial of service.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-19149
CVE-Crit: MEDIUM
CVE-DESC: Poppler before 0.70.0 has null pointer dereferencing in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-21009
CVE-Crit: HIGH
CVE-DESC: Poppler before version 0.66.0 has integer overflow in Parser :: makeStream in Parser.cc.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-12293
CVE-Crit: HIGH
CVE-DESC: Poppler before version 0.76.1 has a redundant heap-based buffer read in JPXStream :: init in JPEG2000Stream.cc over data with incompatible height or width.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-14494
CVE-Crit: HIGH
CVE-DESC: An issue was discovered in Poppler before version 0.78.0. Division by zero error in SplashOutputDev function :: tilingPatternFill on SplashOutputDev.cc.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-9959
CVE-Crit: MEDIUM
CVE-DESC: The JPXStream :: init function in Poppler 0.78.0 and earlier does not check for negative stream length values, resulting in an integer overflow that allows a large chunk of memory to be allocated in the heap with a size controlled by the attacker, as demonstrated by pdftocairo.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2020-27778
CVE-Crit: HIGH
CVE-DESC: A bug was discovered in Poppler in the way certain PDF files were converted to HTML. A remote attacker could exploit this vulnerability by providing a malicious PDF file that, when processed by the pdftohtml program, would crash the application, causing a denial of service.
CVE-STATUS: default
CVE-REV: default

OSVersionArchitecturePackageVersionFilename
Cobaltanynoarchpoppler< 0.26.5UNKNOWN

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.022

Percentile

89.5%